Environment Variables
Environment file ownership and the public, server-only, billing, email, and proof variables used by the template.
Environment files
| File | Owner | Use |
|---|---|---|
.env.local | Local runtime | Generated local Supabase values plus local Stripe and email settings |
.env | Customer/operator | Optional ignored local copy of production-oriented values; configure providers directly |
.env.example | Repository | Non-secret key inventory and safe local placeholders |
Run bunx supabase start before ./coremvp env sync; the template CLI writes
the running local Supabase values to .env.local. You own .env and each
provider's environment configuration.
Never commit .env or .env.local. Use ./coremvp env list to inspect key
presence without printing secret values.
App, Supabase, and database
Prop
Type
Local DATABASE_URL points to the direct Supabase Postgres port. Add the hosted
DATABASE_URL to ignored local .env and Vercel Production yourself, then run
./coremvp db verify against that local value before deployment. Compare the
configured connection identity—endpoint, configured db, and configured user—with the linked project's Connect panel. For a Shared Pooler URL,
configured user must contain postgres.<project-ref>. Stop if any configured
field differs. Continue only when the expected app tables are present. The
verifier does not query Supabase project metadata.
Stripe
Prop
Type
For local billing, run
stripe listen --forward-to localhost:3000/api/webhooks/stripe, copy the
displayed signing secret to STRIPE_WEBHOOK_SECRET in ignored .env.local,
and restart bun run dev.
Email and hosted proof
Prop
Type
Platform-provided values
Vercel supplies VERCEL_URL and related platform state. The template uses
NEXT_PUBLIC_APP_URL as the explicit canonical production URL; set it to your
final domain before launch.
Security rules
| Rule | Reason |
|---|---|
Expose only NEXT_PUBLIC_* keys to browser code | Other keys authorize server or provider actions |
Keep DATABASE_URL server-only | It grants direct app-database access |
| Keep Stripe, Supabase admin, Resend, and proof tokens server-only | They can mutate provider state or access protected proof |
| Use test Stripe keys locally | Local checkout must not create live charges |
See Configuration for the local happy path and Vercel Deployment for production setup.
Was this page helpful?